Kernel Warnings snoop_cache_unresolved

  • 0
  • 1
  • Question
  • Updated 1 year ago
  • Answered
Hi Guys

Having a load of these warnings pop up in the logs on my stack and I don't seem to find anything on the forums about it.

<Warn:Kern.Card.Warning> Slot-1: exosSnoop: snoop_cache_unresolved:800: Dropping v4 packet with src:x.x.x.x dest:x.x.x.x vlan: **** as number of resolved cache entries reached maximum limit

I take it this has something to do with Multicast? If not any info would be great.
Photo of Josh

Josh

  • 110 Points 100 badge 2x thumb

Posted 1 year ago

  • 0
  • 1
Photo of Ram

Ram, Employee

  • 1,450 Points 1k badge 2x thumb
These messages are generated by the exsnoop kernel module, and it generates this message if 2048 or more packets are queued up to be processed by the snooping module. This message is logged the first time this limit is hit, and thereafter for every 10000 packet that hits this condition.
Photo of Josh

Josh

  • 110 Points 100 badge 2x thumb
Is the snooping module enabled by default as I don't have it defined anywhere in my switch configs.

Would it be worth disabling the snooping module?
Photo of Ram

Ram, Employee

  • 1,450 Points 1k badge 2x thumb
By default, it is enabled.

Please share the below outputs:
a. debug hal show ipv4mc
b. show mcast cache
c. show igmp snooping vlan vlan2018

- Is this a valid destination group address in the network?
- Who is the source IP, any kind of server which generates multicast packets?
Photo of Josh

Josh

  • 110 Points 100 badge 2x thumb
HiĀ 

Running recommendation C on one of our VLAN's and found an IP that seems to be claiming a huge amount of groups.

I will take a look into the IP and post back.

But it isn't the IP that I see being dropped in my logs. Would this be due to this one host taking up so much of the cache that the other IP's in the group get dropped because the cache limit is hit?

- Josh
Photo of Josh

Josh

  • 110 Points 100 badge 2x thumb
I take it this has been marked as resolved?
Photo of Drew C.

Drew C., Community Manager

  • 40,206 Points 20k badge 2x thumb
Hi Josh, yes, it looks like this was marked resolved a few days ago. Has the information in the thread helped?
Photo of Josh

Josh

  • 110 Points 100 badge 2x thumb
It did indeed but I was hoping to get more info from my last reply.